Potential modification or disclosure of persisted data in RA, SAP security note 1637408

SAP Note 1637408
SAP Security Note
High priority

SAP security note 1637408, “Potential modification or disclosure of persisted data in RA”, is released on 13.11.2012. Below are the symptom, SAP recommended solution and the affected software components.

ComponentIndustry-Specific Component Retail – Returns Authorization (IS-R-RA)

PriorityCorrection with high priority

TypeSAP Security Note

StatusReleased for Customer

Released on13.11.2012

Description

Symptom

An attacker can exploit the ReturnsAuthorization Web Application by using specially crafted inputs to modify database commands. This can result in the retrieval of additional information or the modification of data persisted by the system.

Solution

This vulnerability has been corrected in RA 2.7.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability. The code composes an SQL statement that includes strings that can be altered by an attacker. The manipulated SQL statement can then be used to retrieve additional data from the database or modify the data.

Affected components

XRETURNS 260
XRETURNS 270

Full note on SAP: SAP Support Launchpad note 1637408

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#SQL injection
#database
#access control
#ReturnsAuthorization
#RA